# Location technology

> How Ironchip turns the radio environment of a place into an anonymous safe zone: the signals it uses, what it stores, the fraud it detects and how to integrate.

URL: https://docs.ironchip.com/en/tecnologia/

_Location intelligence_ is the ability to use the real physical location of the user, derived from signals in the environment (mobile networks, Wi-Fi and IP, with GPS as a contrast signal), as an identity factor that is very hard to forge. It is the technology behind Ironchip's identity platform and fraud detection.

Gartner identifies _location intelligence_ as one of the emerging pillars of authentication and identity systems (_location identity proof_). The premise is that location is a unique piece of context, hard to forge and highly predictive of legitimate behavior.

[Image: Gartner diagram of the fraud detection layers: location intelligence alongside bot mitigation, device ID and behavioral biometrics]

## Why cybercriminals hide their location

Attackers use several techniques to mask their real location:

- **VPNs and proxies:** they change their IP address to appear to be somewhere else.
- **TOR network:** it routes traffic through several encrypted nodes and hides its origin.
- **Fake GPS (FakeGPS):** apps that spoof the device's GPS to report false coordinates.
- **SIM swapping:** they swap the device's SIM to simulate a different carrier or country.

## How Ironchip's technology works

Every place has its own radio environment: the Wi-Fi and mobile networks visible from that point, with their strength and how they relate to each other. That wave pattern is as distinctive as a fingerprint, and it is what Ironchip learns. The fingerprint is neither coordinates nor personal data. An attacker can steal a password, clone a SIM or spoof coordinates, but cannot reproduce the full electromagnetic environment of a specific place.

The process has four phases:

1. **Capture.** On each operation, the SDK measures the visible spectrum: antennas, Wi-Fi, GPS, IP, latencies and ISP. Capture is passive and transparent to the user.
2. **Signature modeling.** Repeated captures of the same point are grouped and condensed into an anonymous signature, with no coordinates or personal data.
3. **Comparison on every access.** Each new access generates its own capture, which is measured against the stored signature. If they are similar enough, the location factor is met; if not, the access does not pass.
4. **Continuous learning.** The system learns each user's usual places and detects geographic anomalies, without the limits of static zones.

### Signals that are captured

Every time a user interacts with a mobile or web application, Ironchip captures and analyzes these signals from the physical environment. None of them identifies the user on its own: it is their combination, and how it varies, that describes a place.

| Signal          | What is analyzed                                                       |
| --------------- | ---------------------------------------------------------------------- |
| Mobile networks | Visible 2G, 3G, 4G and 5G antennas and their carrier.                  |
| Wi-Fi           | Networks in the environment and the user's favorite network.           |
| GPS             | Device coordinates, only as a contrast signal and never as sole proof. |
| IP              | IP address and Internet service provider (ISP).                        |
| Geolocation     | Based on network latency.                                              |
| Native SIM      | Carrier and country of the SIM actually in use.                        |
| Cell towers     | Connectivity with the antennas.                                        |
| Antispoofing    | Detection of VPN, TOR, proxies and fake GPS.                           |

None of the concealment techniques can forge all the signals of the physical environment at the same time and in real time. That is the key to Ironchip.

### How a safe zone is generated

A safe zone is the core of Ironchip's _location intelligence_ technology: a unique, usual and anonymous place associated with each user. It is not a point on a map.

| Concept             | Description                                                                                                                                                       |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| What it is          | A unique, familiar place for each user. It represents where the legitimate user usually operates.                                                                 |
| How it is generated | By AI, which captures and analyzes the signals of the environment (mobile networks, Wi-Fi and IP, with GPS as contrast) on every interaction with an application. |
| Continuous learning | Each interaction teaches Ironchip's AI the relationship between places and devices over time.                                                                     |
| Privacy by design   | Safe zones are anonymous: the exact address is not stored, only patterns of encrypted signals.                                                                    |
| Dynamic updates     | The model adapts without friction to the user's legitimate changes (moving house, regular trips, and so on).                                                      |

A safe zone **is** an anonymous signature of the radio environment, bound to the device key, and a factor that detects spoofing, VPNs, TOR, virtual SIMs and impossible travel. It **is not** a set of GPS coordinates or a history of the user's movements, and it is not personal information: a street or a building cannot be deduced from the signature.

To learn how safe zones are managed in the console, see [Safe zones](https://docs.ironchip.com/en/identidad/conceptos/zonas-seguras/). Data handling is detailed in [Location data privacy](https://docs.ironchip.com/en/tecnologia/privacidad/).

## Why location is the best predictor

Internal data and market studies indicate that location is the identity factor that best tells legitimate behavior from fraudulent behavior:

| Type of operation                      | Result                                                                    |
| -------------------------------------- | ------------------------------------------------------------------------- |
| User registration                      | 92% of users register from known locations.                               |
| E-commerce and purchases               | 74% of purchases are made from usual places.                              |
| Sign-in                                | 68% of sign-ins happen from familiar locations.                           |
| High-value transactions (over €10,000) | More than 94% are made from trusted places.                               |
| Fraudulent patterns                    | 98% of attacks happen remotely from locations unknown to the user.        |
| Repeat fraud                           | 99% of fraudsters repeat the fraud from the same location at least twice. |

## Types of fraud it detects

| Type of fraud                | How Ironchip detects it                                                                                                                      |
| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| SIM swapping                 | Detects SIM carrier changes, ISP changes and inconsistent geolocations in real time.                                                         |
| Phishing and AiTM            | The browser extension ([Phishing Shield](https://docs.ironchip.com/en/phishing-shield/)) blocks fraudulent sites before the user signs. It validates the destination. |
| Vishing                      | Detects whether the user is on a call during critical actions, such as validating a PIN.                                                     |
| Synthetic identities         | New accounts from blacklisted locations or with atypical behavior from the first access.                                                     |
| Money mules                  | Detects a combination of impossible travel, SIM or carrier changes and VPN use.                                                              |
| Malware and RAT              | Detects debugging processes, overlays and active keyloggers on the device.                                                                   |
| GPS spoofing                 | Automatic detection when RF geolocation (Wi-Fi and 5G) does not match the reported GPS.                                                      |
| Device swapping              | Detects a sudden device change from an untrusted location with a fraud pattern.                                                              |
| Rooted or jailbroken devices | Identifies devices with root access and automatically flags them as high risk.                                                               |

How these signals are combined into a score is explained in [Risk assessment](https://docs.ironchip.com/en/fraude/conceptos/evaluacion-de-riesgo/).

## Technical integration: SDK and API

Ironchip offers two components to integrate _location intelligence_ into any application:

| Component           | Function              | Details                                                                                                                                 |
| ------------------- | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| Datasource SDK      | Signal capture        | Platforms: Android, iOS, Flutter and web. It integrates into any mobile or web application to capture environment signals in real time. |
| Fraud Detection API | Results and decisions | Protocol: REST HTTP API. Compatible with any BPM or SIEM. Sub-second SLA for real-time alerts.                                          |

See the [fraud detection SDK](https://docs.ironchip.com/en/fraude/sdk/) and the [fraud detection API](https://docs.ironchip.com/en/fraude/api/).

### Integrate location as a service

Location has many use cases: checking where your employees work, isolating access to the company's most critical systems or encrypting communications. You can integrate it into any use case with the API:

- **Secure third-party connectivity:** control supplier access to the company's most sensitive systems.
- **Secure, user-friendly authentication:** authenticate the user with a push notification that analyzes three proofs of identity (device, biometrics and location) and integrates into any service for high-security requirements.
- **Service isolation and protection:** protect access to different systems by restricting it to assigned places.

To add location verification to your own application, see the [identity HTTP API](https://docs.ironchip.com/en/identidad/protocolos/http-api/). To score transactions, use the [fraud detection API](https://docs.ironchip.com/en/fraude/api/).

## Sectors

| Sector                        | Applications                                                             |
| ----------------------------- | ------------------------------------------------------------------------ |
| Banking and finance           | Secure transactions, fraud detection and NIS2 and ENS compliance.        |
| Government and public sector  | Access to critical services, employee authentication and ENS compliance. |
| Industry                      | Protection of access to OT and IT systems and supplier monitoring.       |
| Pharmaceutical and healthcare | Protection of patient data and secure remote access.                     |

## What sets Ironchip apart

Ironchip brings these elements together in a single platform:

| Differentiator        | Detail                                                                                                                                                                             |
| --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| RF-based location     | Combines Wi-Fi, 2G/3G/4G/5G and IP signals at once, with GPS as contrast, for a geolocation that is very hard to forge.                                                            |
| No credential storage | It stores no credentials (_zero credential storage_), which removes the most common attack vector (theft of password databases).                                                   |
| Real-time detection   | Sub-second SLA from signal capture to the block or access decision.                                                                                                                |
| Universal integration | SAML, OIDC, RADIUS, LDAP, SSH and RDP, with modern cloud applications and legacy on-premises systems.                                                                              |
| No mandatory hardware | OpEx model (pay per use), with no physical stock or hardware logistics for ENS.                                                                                                    |
| ENS High              | Product listed in the CCN-CERT catalog at the HIGH level of the Spanish National Security Framework (ENS), suitable for critical environments. More in [Security](https://docs.ironchip.com/en/seguridad/). |
| Fraud behavior        | 99% of fraudsters repeat the same location: Ironchip learns and blocks from the second time.                                                                                       |

## Frequently asked questions about the technology

### What is location-based authentication?

It means using the place an access comes from as one more factor. Ironchip does not depend on coordinates: it compares the radio signature of the environment, made up of the visible mobile and Wi-Fi networks, with that of the authorized zones. GPS is just one more signal, and the engine detects when it is spoofed.

### Does it work inside buildings, where GPS does not reach?

Yes. The signature is based on mobile and Wi-Fi network signals, which are present indoors. GPS is used only as contrast.

### Can it be fooled with a VPN or fake GPS?

It is very hard. To impersonate a place, you would have to reproduce its full electromagnetic environment. The engine also detects spoofed GPS, VPNs, TOR, proxies and inconsistencies between the IP, the SIM and the place's signature.

### What data is stored about the place?

An anonymous signature of the radio environment, bound to the device key. No addresses or movement history are stored, and the signature cannot be turned into a specific location. More detail in [Location data privacy](https://docs.ironchip.com/en/tecnologia/privacidad/).